v0.10.4 — Permission UX cleanup

Permission UX cleanup

Drops Input Monitoring from the onboarding and Settings surface entirely — the app never actually needed it, and the Request button could not recover after the first denial (macOS silently suppresses the prompt forever once dismissed).

The real fix: this app does not need Input Monitoring at all. Carbon RegisterEventHotKey (global hotkeys) and CGEvent posting (paste-at-caret) both run on Accessibility alone.

Removed

• Input Monitoring permission row from onboarding and Settings.
• PermissionManager.inputMonitoringGranted + requestInputMonitoringIfNeeded deleted. If a future feature genuinely needs CGEvent tap, the probe + request closure pattern is easy to add back.

Improved

• Auto-open Settings fallback for Accessibility — when requestAccessibilityIfNeeded() fires and the prompt is silently suppressed (because the user previously denied), a 1.5-second grace task re-checks the live grant. If still not granted, System Settings opens to the Accessibility pane automatically. No more "I clicked Request and nothing happened" dead end.

Build pipeline

• scripts/package_dmg.sh now codesigns the DMG wrapper with Developer ID before notarization. v0.10.3's manually-built DMG had this; the script did not.

Tests

• PermissionManagerTests drops 2 Input Monitoring assertions and adds 2 new ones pinning the auto-open Settings contract: fires when grant misses the grace window; skipped when grant arrives in time. 390 tests pass (was 388, +2).

Risk-free upgrade

UserDefaults + Keychain layout unchanged from v0.10.3.

Install

• Recommended: download the DMG below — open, drag the app into Applications, launch.
• Sparkle auto-updates from v0.10.3 onwards work too (pulls the ZIP).

Both the DMG and the ZIP are signed (Developer ID JP4XV8A9JF), notarized by Apple, and stapled. Apple Silicon only. macOS 14 or later.